Repository navigation
Host-owned Octos app peers and Rinx deployment modes (ADR 0007) - #25
Merged
Merged
Conversation
Rinx no longer discovers AppCard's published connection. It consumes the
scoped assistant service of octosense-app-peers (OctoSense-System-Apps
crates/app-peers) in three deployments:
- Hosted: the OctoSense shell offers a service when it creates the Rinx
module; RinxModule::create claims it for its instance. No fallback
kernel, no AI credentials, no AppCard; without an offer Rinx has no
assistant. The module declares the four exact octos.* services.
- Standalone local: Rinx owns one runtime, the packaged octos beside the
executable (never PATH), under its own data root. It starts on the first
authorized request and stops on exit (only that runtime).
- Standalone remote: an explicit server authenticated by its token (kept in
memory only); the server provisions the workspace and keeps running.
Every mini-app instance gets its own kernel request context of Rinx's peer
(separate transcript, workspace and memory namespace; octos UPCR-2026-034).
Admission and dispatch use exact service names, account changes revoke,
hosted close releases, and stale replies are dropped. The octos-local and
octos-remote features keep the runtime out of octosense-module builds.
Adds ADR 0007 with its implementation record, and process-level tests
against a real kernel and a real authenticated octos serve with scripted
models (tests/standalone_{local,remote}.rs, gated on RINX_TEST_OCTOS_BIN).
App Hub moves to 46d67e51, which publishes the service names.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
makepad db4691d0 (makepad#35) and OctoScript-Makepad c3d53ba8 (#46) carry the Splash reapply_text and stateful-input support the mini-app host uses on the current runtime (d0a9def5 / 99c1e5ee), so OctoSense shells can link Rinx at their pins. octosense-app-peers 4fa0f122 carries the kernel's host token (octos UPCR-2026-034 review); Rinx keeps it under octos/peers (0600) so a restart resumes its peer. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
One source identity for octosense-app-policy when a shell links Rinx, without URL-alias patches. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements ADR 0007 on top of #24 (stacked; base
feat/octoscript-miniapps). The ADR is added here with status and an implementation record; the evidence table lives in the ADR.What changes
KernelProvider::shared/octos-app-transportare gone. Rinx consumes the scopedOctosAppServiceofoctosense-app-peers(OctoSense-System-Appscrates/app-peers,64aa865e).src/octos_service.rs):RinxModule::createclaims the service the shell offered to this instance (injection::claim("rinx", scope)). There is no fallback kernel, no credentials and no AppCard. Without an offer there is no assistant, and the settings entry points to OctoSense Settings → Accounts → AI providers.octosbeside the executable, or an explicitRINX_OCTOS_BIN; neverPATH— under Rinx's data root. It starts on the first authorized request and stops on exit (only that runtime).octos.*names (nostarts_with("octos.")). Account changes revoke viainvalidate_sessions, hosted close releases, and stale replies are dropped.module.rsdeclares the fouroctos.*services.standalone = ["octos-local", "octos-remote"].octosense-modulebuilds link no runtime (cargo treehas nooctosense-octos-core).b0591e2c→46d67e51(publishes the exact service names, App Hub#14).Validation (macOS, headless; real kernel = octos#2555 release build, scripted models, fixture token)
cargo test --locked --features agent_chat --lib: 218 passed.tests/standalone_local.rs: no kernel before the first request; one runtime shared by two mini apps with separate contexts; originator_main:api:rinx#root; exit stops only Rinx's kernel while another owner's survives; restart resumes the same peer.tests/standalone_remote.rsagainstoctos serve --auth-token: wrong token refused; turn in a server-provisioned workspace; the token is never on disk; an account change drops the late reply; exit leaves the server running.cargo check --liband--no-default-features --features octosense-module: no new warnings.--no-default-features --features agent_chatbuilds.Unverified: native UI runs, hosted desktop in OctoSense-Desktop (shell wiring in a follow-up), and OnePlus 6 ROM Home (device not touched).
Depends on octos#2555 for kernels with UPCR-2026-034 (older kernels are refused with a clear reason, never substituted).
Note for #24's author: an uncommitted parallel ADR 0007 boundary (
HostedRinxModule/OctosHost) exists in a local working tree. This PR supersedes that approach with the shared System-Apps broker.🤖 Generated with Claude Code